The guardian of your network.

The opening dashboard is the whole network at a glance: block rate, query volume and resolver health. Counters update as queries land, so you can keep traffic under watch in real time.

• Block rate — 1h, 8h, 24h and 7d, side by side, so you can see how the filter is holding and spot an anomaly before it settles in
• Live volume — query rate and record types as they land, so a quiet evening is obvious, and a sudden climb or a burst of unusual types is the first sign a device is misbehaving
• Top offenders — which list is catching the most, and which devices are sending the most queries, so you can start to understand what the network is actually doing
• Resolver health — cache hit rate, peak load and daemon poll, so you know the resolver is answering — not just that the filter is blocking

The live log is every query from every device, as it lands. Isolate a host, read the type and the result, then write an allow or a block from the row itself — onto a list you can mount on a profile.

• Every query — time, client, domain, type, result and RTT, so you can see who asked, what was decided, and how long it took
• Filter by device — every query from one host, then narrow by domain, time, or blocked-only, so you can follow a single device without the rest of the LAN in the way
• Query type — A, AAAA, HTTPS and the rest on each row, so you can tell IPv4 lookups from IPv6, and see how a device is trying to connect
• Act on the row — take the name on the row and write it into a custom allow or block list, then mount that list on the profiles that should use it

Warden already sees every client. Map a host so you recognize it, catalog it by owner, type and department, then read how much it talks and how much of that is blocked.

• Map a device — pick a host on the LAN and give it a name, so you read kids-ipad, not 192.168.1.107
• Catalog in layers — owner, type, department and group on the same host, so you can segment kids from work laptops, or one department from another
• Traffic and block rate — queries today and blocked % on every row, so you can see what a device is actually doing, not only that it exists
• The whole LAN — mapped and still unmapped, last seen a minute ago or last week, so a new phone or a forgotten gadget cannot hide

Profiles pick the lists. Attach a profile to a group of devices — or to a whole subnet — then decide, per profile, whether a feed is a blocklist, an allowlist, or silent.

• Profiles on groups — write a profile and attach it to a group of devices, so the kids' tablets and the work laptops do not share one policy
• Flip the nature — a list that blocks on one profile can allow on another, so the same feed is not the same rule everywhere
• One list, many settings — inherit, invert, or make it inert for a profile, without copying the file
• A whole subnet — attach a profile to a CIDR, so a lab range or the guest Wi-Fi gets the rules without naming every host